Vista - No Telnet, really?

Telnet is bad, mkay? It's insecure. I get it. Everything goes in plaintext totally in the clear. However, it's still a useful tool. Vista (including Ultimate) apparently feels that such a powerful tool should be hidden away from prying eyes and doesn't install it by default.

To install the Microsoft telnet client, do the following:

1. Go to the Control Panel
2. Open Programs and Features
3. Go to Turn Windows features on or off (requires a UAC authentication if you don't have UAC turned off.)
4. Click the check box next to Telnet Client
5. Hit OK
6. "Please wait while the features are configured. This might take several minutes."
7. No, really, it takes a minute
8. Enjoy. May I recommend telnetting to towel.blinkenlights.nl for some ASCII Star Wars love?

Edit: Current Windows 7 Betas behave in the same manner.

Windows Vulnerabilities - 92% mitigated by not being administrator

I'm going to step aside from my normal patching discussions and talk about what happens when you do get attacked with malware that exploits a vulnerability. When a nasty program exploits an unpatched vulnerability, there are always mitigating factors that can help limit the impact. One of the big ones is that the exploit usually runs in the security context of the account which it attacks/is run against. Security vendor BeyondTrust looked at the 154 Microsoft vulnerabilities published in 2008. They found that 92% of all vulnerabilities had their impact mitigated or were rendered completely harmless when the user was running with no elevated privilege (normal user rights). Obviously this is a report from a security vendor selling software that helps manage user rights... but the breakdown for 2008 is striking, indicating that running as non-administrator at least mitigates:

• 94% of Microsoft Office vulnerabilities reported in 2008
• 89% of Internet Explorer vulnerabilities reported in 2008
• 53% of Microsoft Windows vulnerabilities reported in 2008

That makes sense when you realize that the first two categories are just applications. They're very specialized, widespread and extensible applications, hence the risk. Ultimately, however, they're running at the user's privilege level. Even though the OS itself is somewhat less protected-- many of the juicier exploits will run at the System context or elevate privileges-- 53% mitigation is still pretty good.

Here's my beef with Microsoft in this regard. We all know that running in the least level of privilege is the safest and these numbers add good ammunition to that argument. While Microsoft has made great strides in allowing the user to elevate their privilege on some actions in the "XP era" and later, getting the ability to universally change security context on the fly eludes them. *nix with sudo and the standard GUI security elevation method of OS X both have serious problems, but they're a lot closer to right. Windows 7 will certainly continue the slow progress in this area, but at some point Microsoft ought to do better.

Admin Tip: Cable Storage

You've probably accumulated a number of basic computer cables and need to keep a stock of stuff like DVI, VGA, Power, USB A-to-B, etc. Fortunately, most of these come in a standard 6'/2m size!

Get a coat rack or two-- depending on how much you need to store--and affix it to a wall or hang it behind a door at least 4'/2.5m off the ground. Loop the cables over each hook, looping halfway down the cable. Each hook gets its own type of cable. I can get between 25-50 cables per hook, but this will obviously vary with the coat rack you choose and the thickness of the cables.

If you keep Cat 5/5e/6 networking cable in bulk, you can use one hook for each length and/or color. The only problem here is that cables longer than 10' will end up being looped anyway, or they'll be too long for this method.

This is a real time saver in two ways: No more constant bundling cables for storage, and you can easily see and grab what you need when you need it.